Adds the inspection-scanner [apply] command beside launch-suppressor, in its pattern: dry run, all-or-nothing idempotence, partial refuses, ExpectUnchanged batch, root parameter for tests. One Inspection Scanner design (Tool 1x1, one ScannerData) and three products from Finch, AU and Lucent; ToolRolesByDesign gains the design. The catalog itself lands in the next commit. Builds: not yet verified.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>